Can a Small Convolutional Network Still Read Blurred and Pixelated Digits? A Replication of McPherson et al. (2016)

People blur or pixelate faces, license plates, and text, assuming that what cannot be recognized is protected. McPherson, Shokri, and Shmatikov showed that neural networks trained on obfuscated images still recognize their content. In a small replication on handwritten digits, I examined whether a much cheaper version of their attack still works. I trained a small convolutional network for two epochs on pixelated, blurred, or fully masked MNIST digits and compared it with the same network trained on clean digits across ten seeds. The clean-trained model fell from 98.6% to 13.4% (near chance) at the coarsest pixelation and to 36.4% at the strongest blur. Trained on obfuscated digits, the network reached 51.2% and 89.3%. Ten epochs raised the blur result to 94.9% but the coarsest pixelation result only to 51.9%, staying within a point of McPherson et al. and Mahloujifar et al. at both training lengths. Strong blurring and pixelation hurt the clean-trained model far more than the obfuscation-trained model, although the coarsest pixelation still cost the trained model 47 points. The mask, which removes the digit, kept accuracy near chance (11.4%). Rerunning the deterministic experiment reproduced every result exactly.

This record holds the paper (paper.pdf) and its code and results (mnist-obfuscation-replication-main.zip, the repository at version 1.0.0, commit b4ba4d8), also at https://github.com/shashwat-deep/mnist-obfuscation-replication.